RW v Österreichische Post AG

1.

When an individual whose personal data are processed seeks to obtain from the data controller information regarding the third parties to whom the data are disclosed, does that person’s right of access necessarily imply that he or she should receive information regarding the specific recipients to whom his or her personal data are disclosed, or may the data controller confine itself to providing information solely regarding the categories of recipients of such disclosures?

2.

That, in essence, is the question put to the Court of Justice in the present reference for a preliminary ruling, made by the Oberster Gerichtshof (Supreme Court, Austria), concerning the interpretation of Article 15(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( 2 ) (‘the GDPR’).

3.

The question referred by the referring court arose in the context of a dispute between RW, a natural person, and Österreichische Post, the principal operator of postal and logistical services in Austria, which, in response to a request for access that RW made concerning his personal data, did not communicate to him information regarding the specific recipients to whom his personal data are disclosed.

4.

Article 15 of the GDPR, entitled ‘Right of access by the data subject’, provides, in paragraph 1(c) thereof:

‘1.   The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

…

…’

5.

On 15 January 2019, RW, the appellant in the proceedings before the referring court, contacted Österreichische Post in order to obtain access, pursuant to Article 15 of the GDPR, inter alia, to the personal data relating to him which Österreichische Post was keeping or had kept in the past and, in the event that those data had been or would be disclosed to third parties, the identities of the recipients of such disclosures.

6.

In its reply, Österreichische Post stated that it used data, to the extent permitted by law, in the context of its activity as a publisher of telephone directories, and that it provided data to business customers for marketing purposes. It then referred to a website from which could be gleaned some general information on the purposes of the processing of RW’s data and which itself referred to another website. That second website in turn contained general notices about data protection and gave some general indications of certain categories of recipient to which Österreichische Post disclosed personal data. However, at no time did Österreichische Post reveal to RW the specific recipients to whom his personal data are disclosed.

7.

RW initiated legal proceedings, seeking an order requiring Österreichische Post to provide him with further information, pursuant to Article 15 of the GDPR, concerning potential transfers of his personal data to third parties and, in the event that his personal data had actually been transferred, concerning the specific recipient or recipients to whom his personal data had been or would be disclosed. RW claims that the information provided by Österreichische Post does not satisfy the legal requirements of Article 15 of the GDPR because it fails to clarify whether or not Österreichische Post has actually transferred his personal data to third parties and, if it has done so, who the specific recipients of those disclosures were.

8.

Both the court of first instance and the appellate court dismissed RW’s application, holding, in essence, that, since Article 15(1)(c) of the GDPR referred to recipients or categories of recipient, that provision allowed the data controller to confine itself to communicating to the data subject the categories of recipient, without having to give the names of specific recipients to whom the personal data of the data subject are disclosed.

9.

RW pursued his claim in an appeal on a point of law before the referring court.

10.

In the course of those appeal proceedings, Österreichische Post informed RW that his data had been processed for marketing purposes in the context of the publication of telephone directories and that they had been transferred to business customers, including advertisers active in the mail order and traditional commerce sectors, IT companies, telephone directory publishers and associations such as charities, NGOs and political parties. It did not, however, reveal the identities of the specific recipients to whom RW’s data had been disclosed.

11.

In that context, the referring court, being in doubt as to the interpretation of Article 15 of the GDPR that had been adopted by the courts ruling on the substance, decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:

‘Is Article 15(1)(c) of [the GDPR] to be interpreted as meaning that the data subject’s right of access is limited to information concerning categories of recipient where specific recipients have not yet been determined in the case of planned disclosures, but that right must necessarily also cover recipients of those disclosures in cases where data has already been disclosed?’

12.

By the question referred, the referring court seeks from the Court of Justice a preliminary ruling on the interpretation of Article 15(1)(c) of the GDPR regarding the scope of the data subject’s right, provided for in that provision, to obtain information from the data controller regarding the recipients or categories of recipient to whom the data subject’s personal data have been or will be disclosed.

13.

The referring court seeks to ascertain whether that provision is to be interpreted as meaning that the scope of the data subject’s right of access must be distinguished according to whether data have already been disclosed, in which case the right should extend to the specific recipients of such disclosures, or whether the specific recipients of future disclosures have not yet been identified, in which case the right should be regarded as limited to information regarding categories of recipient.

14.

In that regard, it should first of all be noted that Article 15 of the GDPR governs the rights of data subjects, exercisable against data controllers, to access personal data concerning them which are being processed, as well as a range of information relating, in particular, to the processing of such data. Article 15 gives specific expression to the right of every individual to access data concerning him or her, enshrined in the second sentence of Article 8(2) of the Charter of Fundamental Rights of the European Union (‘the Charter’). ( 3 )

15.

More specifically, pursuant to Article 15(1) of the GDPR, the data subject has, first of all, the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. Where such data are being processed, the data subject has the right to access the personal data that are being processed, as well as certain further information, listed in points (a) to (h) of that provision. In that context, pursuant to Article 15(1)(c) of the GDPR, the data subject has the right to access information relating to ‘the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations’.

16.

The question referred by the referring court calls for interpretation of Article 15(1)(c) of the GDPR for the purpose of determining the exact scope of the data subject’s right, provided for in that provision, to obtain information regarding the recipients to whom his or her personal data are disclosed.

17.

In this connection, it must be borne in mind that it is settled case-law that the interpretation of a provision of EU law requires account to be taken not only of its wording, but also of its context and the objectives and purpose pursued by the act of which it forms part. ( 4 )

18.

Moreover, since the provisions of the GDPR govern the processing of personal data liable to infringe fundamental freedoms and, in particular the right to respect for private life, they must necessarily be interpreted in the light of the fundamental rights guaranteed by the Charter. ( 5 )

19.

It is also clear from settled case-law that, where a provision of EU law is open to several interpretations, preference must be given to the interpretation which ensures that the provision retains its effectiveness. ( 6 )

20.

As regards, first of all, the formulation of the provision in question, as the referring court itself has pointed out, along with a number of parties that have intervened before the Court, the wording of Article 15(1)(c) of the GDPR does not enable any definitive answer to be given to the question of whether the data subject’s right of access, provided for therein, must necessarily be regarded as extending to access to information regarding specific recipients to whom personal data concerning the data subject is disclosed, or whether it might be limited to access to information regarding categories of recipients. Indeed, in that provision, the terms ‘recipients’ and ‘categories of recipient’ are used in succession, in a neutral way, without any order of priority between them being discernible. Nor does Article 15(1)(c) of the GDPR expressly specify whether a choice may be made between the two possible categories of information envisaged (‘recipients’ and ‘categories of recipient’) or who (the data subject or the data controller) might be entitled to decide on the type of information to which access should be granted.

21.

Nonetheless, again as pointed out by the referring court, the very structure of Article 15(1) of the GDPR tends, in my view, to favour the interpretation of the provision in question as meaning that it is for the data subject (and not, therefore, for the data controller, as the two national courts ruling on the merits in this case held) to choose between the two alternatives specified therein. By contrast with other provisions of the GDPR, such as Article 13 and Article 14, ( 7 ) which are structured in such a way as to place an obligation upon the data controller to provide information, the provision at issue establishes a genuine right of access for the data subject. Logically, the exercise of that right of access by the data subject presupposes that the holder of that right should be allowed to decide whether to obtain access to information concerning, where possible, the specific recipients to whom the data have been or are to be disclosed or, alternatively, to confine himself or herself to requesting information regarding categories of recipient.

22.

An interpretation of Article 15(1)(c) of the GDPR according to which that provision establishes the right of the data subject to request, where possible, access to information regarding the specific recipients to whom his or her personal data are disclosed is, moreover, confirmed by an analysis of both the context in which the provision appears and its purpose, in the light of the objectives and overall structure of the GDPR.

23.

In this connection, I would, at the outset, point out that recital 63 of the GDPR expressly states that data subjects should ‘have the right to know and obtain communication … with regard to … the recipients of the personal data’. That recital, in the light of which the provision in question must be interpreted, relates the data subject’s right of access to the specific recipients to whom his or her personal data are disclosed and in no way mentions that that right may be restricted, at the data controller’s discretion, merely to categories of recipients.

24.

Moreover, the case-law makes it expressly clear that the purpose of the GDPR is, in particular, as recital 10 thereof makes clear, to ensure a high level of protection of natural persons within the European Union and, to that end, to ensure a consistent and homogeneous application of the rules for the protection of the fundamental rights and freedoms of such natural persons with regard to the processing of personal data throughout the European Union. ( 8 )

25.

To that end, any processing of personal data must comply with the principles set out in Article 5 of that regulation. ( 9 ) It is clear in particular from Article 5(1)(a) of the GDPR that personal data must be processed in a transparent manner in relation to the data subject. ( 10 ) In that context, Article 15 of the GDPR, which governs the data subject’s right of access, constitutes a fundamental provision for ensuring that the manner in which data are processed is transparent for data subjects.

26.

As is clear from recital 63 of the GDPR, ( 11 ) the purpose of this right of access is, in the first place, to enable the data subject to be aware of the processing of his or her data and to verify the lawfulness of that processing. ( 12 ) Exercising the right of access must, in particular, enable the data subject to check not only that the data concerning him or her are accurate, but also that they are disclosed to authorised recipients. ( 13 ) That, in principle, implies that the information provided must be as precise as possible.

27.

Against that background, I agree with the European Commission that to hold that the right of access of data subjects provided for by Article 15(1)(c) of the GDPR does not extend to specific recipients, and so restrict that right purely to categories of recipient, would be tantamount to preventing the data subject from being able fully to verify the lawfulness of the processing carried out by the data controller and, in particular, to verify the lawfulness of any disclosures of the data already made. Such an interpretation of the provision in question would not enable the data subject to verify that his or her data have been sent only to authorised recipients, which would be contrary to the requirements mentioned in the preceding point.

28.

In the second place, and in relation to the first objective, this right of access is necessary, as indeed the Court has already observed, to enable data subjects to exercise the right to rectification, the right to erasure (the ‘right to be forgotten’) and the right to restriction of processing, conferred on them by Articles 16, 17 and 18 of the GDPR respectively. ( 14 ) The Court has also made it clear that the right of access is also necessary to enable data subjects to object to the processing of their personal data, as provided for by Article 21 of the GDPR, and to take legal action in the event that they suffer harm and to obtain compensation, in accordance with Articles 79 and 82 of the GDPR. ( 15 )

29.

An interpretation of the provision in question according to which data subjects could not obtain information regarding the specific recipients to whom their personal data are disclosed would have the consequence that, ignorant of the identities of such recipients, data subjects would not be in a position to exercise against them the rights conferred on them by the abovementioned provisions of the GDPR or would be able to exercise those rights only by making a disproportionate effort. ( 16 ) Such an interpretation would thus deprive those provisions, and the rights which they confer, of their effectiveness in such situations.

30.

From a contextual perspective, the abovementioned interpretation of Article 15(1)(c) of the GDPR is moreover confirmed by the provision in Article 19 of that regulation. That article provides that ‘the controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort’.

31.

Article 19 of the GDPR thus requires the data controller to inform all recipients to whom it has transferred personal data of any request for the rectification, erasure or restriction of processing of those data with which the controller must comply. Recipients so informed are then required immediately to rectify, erase or restrict the processing of the data, to the extent that they are still processing the data in question. In pursuit of the objective of ensuring a high level of protection, mentioned in point 24 of this Opinion, Article 19 of the GDPR is intended to relieve data subjects who have requested information pursuant to Article 15(1)(c) of the GDPR of the burden of sending further corresponding requests for rectification, erasure or restriction of processing to the recipients concerned. Nonetheless, the data subject must be put in a position to verify that the rectification, erasure or restriction has actually been carried out following notification by the data controller. To that end, Article 19 of the GDPR therefore provides that the data controller must inform the data subject of those recipients if the data subject requests it.

32.

Article 19 of the GDPR confirms that, in order to ensure the effectiveness of the data subject’s rights to rectification, to erasure and to restriction of processing provided for by Articles 16, 17 and 18 of the GDPR, the data subject must in principle have the right to be informed of the identities of specific recipients, where his or her personal data have already been disclosed. Indeed, only in this way can the data subject assert his or her rights against them.

33.

It follows from the foregoing considerations that the right of access under Article 15(1)(c) of the GDPR plays a functional and instrumental role in the exercise of the other rights which the GDPR confers on data subjects. It follows that, in order to ensure the effectiveness of all the abovementioned provisions of the GDPR, Article 15(1)(c) must be interpreted as meaning that the right of access under that provision must, in principle, necessarily include the right to obtain from the data controller information regarding the specific recipients to whom the data subject’s personal data are disclosed.

34.

The extension of the right of access under Article 15(1)(c) of the GDPR to the specific recipients of such disclosures is, however, restricted, in my view, in at least two cases.

35.

First, where it is materially impossible to provide information about specific recipients, for example, because they have not yet actually been identified, clearly, the data controller cannot be expected to communicate information that does not yet exist. Accordingly, in such a case, which is expressly contemplated by the question referred for a preliminary ruling, the data subject’s right of access can relate only to categories of recipient.

36.

Secondly, as the Italian Government has pointed out, the exercise of the data subject’s right of access and the performance of the corresponding obligation on the data controller must be considered in the light of the principles of fairness and proportionality.

37.

In this connection, it must be borne in mind that, as is clear from the Court’s case-law, the rights enshrined in Articles 7 and 8 of the Charter are not absolute rights, but must be considered in relation to their function in society. ( 17 )

38.

On that point, it is clear from Article 12(5), which applies expressly to the provision that is the subject of the question referred for a preliminary ruling, that requests from a data subject must not be manifestly unfounded or excessive and that, if that is the case, the data controller may even refuse to act on the request. It is also clear from the same provision that the controller bears ‘the burden of demonstrating the manifestly unfounded or excessive character of the request’.

39.

Moreover, the Court itself has already had occasion to clarify that a fair balance must be struck between the individual’s interest in protecting his or her privacy, in particular, by way of the rights enshrined in Chapter III of the GDPR and the possibility of taking legal action, on the one hand, and the burden on the data controller, on the other. ( 18 ) That fair balance leans toward greater attention being paid to the protection of the data subject’s data and privacy, as is made clear by the requirement that, in order to refuse to act on a data subject’s request for access, it is necessary to demonstrate that the request is manifestly unfounded or excessive.

40.

In light of all the foregoing considerations, I propose that the Court answer the question referred for a preliminary ruling by the Oberster Gerichtshof (Supreme Court, Austria) as follows:

Article 15(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that the data subject’s right of access, provided for therein, must necessarily extend, where the data subject so requests, to the identification of the specific recipients to whom his or her personal data are disclosed. That right of access may be restricted to an indication of the categories of recipient where it is materially impossible to identify the specific recipients to whom the personal data of the data subject are disclosed or where the data controller demonstrates that the data subject’s requests are manifestly unfounded or excessive, within the meaning of Article 12(5) of Regulation 2016/679.